vulnerability announce 12152

SAP NetWeaver: file reading via an XML entity

Synthesis of the vulnerability

An attacker can transmit malicious XML data to the CCMS service of SAP NetWeaver, in order to force it to include a file, which can then be returned to the attacker.
Impacted products: SAP ERP, NetWeaver.
Severity: 2/4.
Creation date: 15/11/2012.
Revision date: 31/01/2013.
Identifiers: 1715040, BID-57654, DOC-8218, DSECRG-12-049, VIGILANCE-VUL-12152.

Description of the vulnerability

XML data can contain external entities (DTD):
  <!ENTITY name SYSTEM "file">
  <!ENTITY name SYSTEM "http://server/file">
A program which reads these XML data can replace these entities by data coming from the indicated file. When the program uses XML data coming from an untrusted source, this behavior leads to:
 - content disclosure from files of the server
 - private web site scan
 - a denial of service by opening a blocking file
This feature thus must be disabled to process XML data coming from an untrusted source.

However, the CCMS service allows external entities.

An attacker can therefore transmit malicious XML data to the CCMS service of SAP NetWeaver, in order to force it to include a file, which can then be returned to the attacker.
Complete Vigil@nce bulletin.... (free access)

Share this bulletin

          

Computer vulnerabilities tracking service

Vigil@nce provides a system vulnerability watch. The technology watch team tracks security threats targeting the computer system. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications. The Vigil@nce vulnerability database contains several thousand vulnerabilities.